Security and HIPAA
Last updated September 29, 2026.
HIPAA business associate
Captrix signs a business associate agreement (BAA) with every practice before any patient information enters the system. We hold BAAs with the vendors that touch patient information on our behalf, including our cloud host.
Multi-factor login for every staff member
Every staff login requires a second factor, by text code or an authenticator app. It cannot be turned off.
Encryption
Sensitive fields are encrypted with AES-256 before they are stored. File storage is encrypted, and all traffic to and from Captrix uses TLS.
Role-based access
Each person has their own login and an owner, admin or staff role.
Access log
Every view of a patient record is logged with who, what and when. Practice owners can review the log at any time.
US hosting on AWS
Captrix runs on Amazon Web Services in the United States. AI features run on Amazon Bedrock in our own AWS account, or with vendors that have signed a BAA with us.
How we handle patient data
The practice owns its data. We use it only to run the service for that practice. We never sell it, never use it for advertising, and never use patient information to train AI models.
Patient texts follow each patient's choice. A patient who replies STOP, or tells the practice not to text them in any words or language we support, is not texted again.
When a practice leaves Captrix, we return its data on request and then delete it, as set out in our terms and the practice's BAA.
Report a security concern
Email jack@captrix.ai. We reply within one business day. Practices can request a copy of our BAA and security answers for their own review.